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UNITED STATES DISTRICT COURT 
DISTRICT OF MASSACHUSETTS 


UNITED STATES OF AMERICA 
CRIMINAL NO. 21-cr-10104-PBS 


V. 


VLADISLAV KLYUSHIN 
Defendant 


SO OO a aS aS SS 


DEFENDANT VLADISLAV KLYUSHIN’S OMNIBUS MOTION IN LIMINE 
Now comes the defendant Vladislav Klyushin, by and through undersigned counsel, and 
hereby respectfully submits the following in limine requests: 


EVIDENCE OF ERMAKOV’S OTHER INDICTMENTS AND ASSOCIATED 
CONDUCT SHOULD BE EXCLUDED AS ILLICIT PROPENSITY PROOF 


Codefendant Ivan Ermakov is reportedly the subject of 2018 federal indictments in 
Washington, DC and Western Pennsylvania alleging separate computer hacking schemes — 
unrelated to each other or the one charged here — involving purported 2016 US election 
interference and international anti-doping agencies, respectively. Never litigated or proven, those 
allegations should be excluded as evidence in this case because they invite illicit propensity 
reasoning, contrary to Fed. R. Evid. 404(b) and 403. 

As an initial matter, it has long been held that a defendant “‘is entitled to have the question 
of his guilt determined upon the evidence against him, not on whether a codefendant or 
government witness has been convicted of the same charge.” United States v. Torres-Colon, 790 
F.3d 26, 30 (1st Cir. 2015) (internal citations omitted). “As a result, [even] the guilty plea of a 
witness cannot be used as substantive evidence to prove the guilt of a defendant charged with 
similar crimes.” Jd. (internal citations and quotations omitted); see also United States v. Woods, 


764 F.3d 1242, 1246 (10th Cir. 2014) (“the government may not borrow proof from another 
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person’s conviction.”). At issue here is unadjudicated conduct of which Mr. Ermakov has never 
been convicted, premised on allegations that have never withstood the adversarial scrutiny of our 
judicial system. That allegations have been made — but never proven — makes their relevance to 
the issues in this case minimal and their introduction against Mr. Klyushin a violation of 
longstanding principles prohibiting introduction of a third-party’s other alleged crimes as 
evidence of those on trial. 

Moreover, Rule 404(b)(1) prohibits the admission of “a crime, wrong, or other act. . . to 
prove a person’s character in order to show that on a particular occasion the person acted in 
accordance with the character.” Such evidence may, however, on a proper showing, be 
admissible “for another purpose, such as proving motive, opportunity, intent, preparation, plan, 
knowledge, identity, absence of mistake or lack of accident.” Rule 404(b)(2). It does not suffice 
for the proponent of the evidence—here, the government—simply to recite the all too familiar 
litany of permissible uses of Rule 404(b) evidence and claim admissibility under one or several 
of them. “[A] proponent’s incantation of the proper uses of such evidence under the rule does not 
magically transform inadmissible evidence into admissible evidence.” United States v. Morley, 
199 F.3d 129, 133 (3d Cir. 1999). The government must demonstrate to the Court’s satisfaction 
that the proffered evidence has “special relevance to an issue in the case,” and the inferential 
chain that the government wishes the jury to follow “must not include bad character or 
propensity as a necessary link.” United States v. Varoudakis, 233 F.3d 113,118 (1st Cir. 2000). 
These allegations against Mr. Ermakov, however, invite nothing but illicit propensity reasoning: 
twice accused of hacking in the past, he must have hacked the filing agents in this case. 


Accordingly, they should be excluded from evidence. 
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Even assuming the two prior allegations serve some proper Fed. R. Evid. 404(b) purpose 
in this case, they fail Fed. R. Evid. 403 balancing. Special relevance “is a necessary but not a 
sufficient condition for the admissibility of Rule 404(b) evidence. Such evidence also must pass 
through the filter of [Rule] 403.” United States v. Raymond, 697 F.3d 32, 38 (1st Cir. 2012). Rule 
403 


requires the trial court to exclude the evidence if its probative value is substantially 
outweighed by “the danger of unfair prejudice.” . . . Otherwise relevant evidence 
may also be excluded if its probative value is substantially outweighed by 
“confusion of the issues, or misleading [of] the jury, or by considerations of undue 
delay, waste of time, or needless presentation of cumulative evidence. 


Varoudakis, 233 F.3d at 121. The term “unfair prejudice,” in the criminal context, “speaks to the 
capacity of some concededly relevant evidence to lure the factfinder into declaring guilt on a 
ground different from proof specific to the offense charged.” Old Chief v. United States, 519 
U.S. 172, 180 (1997). One such improper ground is “generalizing a defendant’s earlier bad act 
into bad character and taking that as raising the odds that he did the later bad act now charged.” 
Varoudakis, 233 F.3d at 122, quoting Old Chief, 519 U.S. at 180. Thus, even where the evidence 
has been admitted for a non-propensity purpose, the real risk that the jury will infer from the 
prior acts a propensity for engaging in unlawful behavior — and on that basis conclude the 
defendant likely committed the charged offenses as well — argues strongly for exclusion under 
Rule 403. That danger looms large in this case, as the government proposes to engulf the jury 
with evidence of alleged prior acts through which it will seek to portray Mr. Ermakov as a 
known hacker. The prospect of unfair prejudice is obvious: since Mr. Ermakov allegedly hacked 
in the past, the jury may be tempted to consider him the kind of person who would knowingly 
and intentionally do it again here. 


Finally, unfair prejudice can arise where the extrinsic evidence offered by the 
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government poses a substantial risk of distracting the jury from the offenses charged, confusing 
the issues before them and wasting both court and jury time through a spate of mini-trials about 
collateral events. See, e.g., United States v. Cook, 454 F.3d 938, 942 (8th Cir. 2006) (affirming 
exclusion of evidence where the government’s “expansive Rule 404(b) evidence presented the 
prospect of mini-trials over the events underlying” the prior acts); United States v. Temple, 862 
F.2d 821, 824 (10th Cir. 1988) (“The government cannot conduct a mini-trial on acts the 
defendant was never charged with under the guise of Rule 404(b).”). Much of the government’s 
prior hacking evidence will necessarily require it to prove the prior unauthorized intrusions, in 
turn compelling the defense to review and rebut computer forensic data to show different means 
and methods of commission, draining them of any bearing on the issues before the jury. In this 
way, what should be a two-week trial will stretch far longer, with the extrinsic evidence 
threatening to overwhelm the evidence probative of Mr. Klyushin’s guilt or nonguilt of the 
offenses charged. See, e.g., United States v. Hough, 385 F. App'x 535, 538 (6th Cir. 2010) 
(affirming exclusion of Rule 404(b) evidence where it would “take a substantial amount of time 
in what would otherwise be a two-to-three-day trial, further leading the jury to place undue 
emphasis on the other acts’). For all of the foregoing reasons, the defense respectfully requests 


this Honorable Court to exclude the evidence of Mr. Ermakov’s prior two indictments. 
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EVIDENCE OF ERMAKOV’S REPUTED RUSSIAN INTELLIGENCE TIES AND 
M13’S CONTRACTS WITH THE RUSSIAN FEDERATION SHOULD 


BE EXCLUDED AS IRRELEVANT AND UNFAIRLY PREJUDICIAL 


Similarly, Ermakov’s reported status as a former military intelligence officer in the Russian 
Federation’s Main Intelligence Directorate of the General Staff — or GRU — has no discernible 
bearing on the charges in this case.' Neither does the fact that Mr. Klyushin’s company, M13, 
provides media monitoring services to, among others, the Government of the Russian Federation. 
Any phantom probative value a creative prosecutor might conjure is dwarfed by the information’s 
potential to inflame the jury’s passions, especially given the current geopolitical situation. The 
Court should exclude any such evidence under Rules 401-03, finding it irrelevant and unduly 


prejudicial. 


' Other than the two unrelated indictments, the government has not proffered any evidence to 
establish Ermakov’s previous ties to the GRU. 
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INFORMATION ABOUT OTHER UKRAINIAN HACKERS THAT MR. KLYUSHIN 
READ IN ARTICLE SHOULD BE EXCLUDED AS IRRELEVANT AND UNFAIRLY 


PREJUDICIAL 


The government may seek to introduce that in August of 2018 Mr. Klyushin read a May 
22, 2017 article titled “Ukrainian hacker gets prison in U.S. insider trading case.” 
https://www.reuters.com/article/us-trading-cyber-plea/ukrainian-hacker-gets-prison-in-u-s- 
insider-trading-case-idUSKBN18I2DF. The article is featured in the background of one the photos 
that was seized from Mr. Klyushin’s iCloud account. The article and the facts of the underlying 
case are irrelevant to the instant charges, based on hearsay and unduly prejudicial. They also risk 
jury confusion and time-wasting minitrials, as the sentence in the referenced case resulted from a 
guilty plea that was a decision personal to the defendant there. Accordingly, they should be 


excluded from evidence. 
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MOTION IN LIMINE TO COMPEL PRODUCTION OF EXPERT’S DATA AND 
ASSUMPTIONS AND EXCLUDE EVIDENCE UNDER DAUBERT 


The government has proffered an expert, Maxwell Clarke, who will testify based on the 
use of a Fisher Exact Test (1) “that the amount of trading around [FA 2] and [FA 1]-related 
earnings events was disproportionately high and could not be explained by chance alone” and 
(2) “to conclude that chance could not explain the frequency with which the [] traders 
consistently predicted unexpected earnings outcomes in their pre-announcement choice of 
trading direction, which occurred, for example, approximately 86 percent of the time in Mr. 
Klyushin’s trades.” Expert Disclosure at 3, attached hereto as Exhibit 1. Additionally, Mr. Clarke 
is expected to testify based “on a non-parametric permutation test, that there is a statistical 
relationship between the time of the download and the investors’ first trade; that in nearly all 
cases, the download preceded the investors’ first trade; and that that relationship cannot be 
explained by chance.” Expert Disclosure at 3-4. 

Though the Fisher Exact and non-parametric permutation tests may be valid ones used by 
statisticians, the defense cannot evaluate Mr. Clarke’s methodologies and opinions without the 
underlying data and assumptions that he relied on. The government has not yet responded to 
additional defense discovery requests relating to Mr. Clarke’s opinions. For example, in 
connection with his opinion that the defendants’ trading around FA 2 and FA | earnings events 
“was disproportionately high,” Mr. Clarke “analyzed whether or not the investors’ proportion of 
[FA 2] or [FA 1]-related trading was reflective of [FA 2] and [FA 1]’s approximate overall share 
in the marketplace for the filing of financial reporting.” Expert Disclosure at 2. This would have 
required Mr. Clarke to determine the public companies that FA | and FA 2 serviced during the 
relevant time and compare them to the public companies serviced by the other filing agent. The 


government has never produced in discovery the client lists of FA 1, FA 2 or the other filing 
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agent. Without that information, the defense simply can’t confirm or deny the accuracy of Mr. 
Clarke’s analyses. 
Similarly, in connection with his second opinion, Mr. Clarke defines “unexpected market 


99 66 


outcomes” “as a situation in which an issuer’s announced financial performance (as measured by 
earnings per share) differed by a threshold amount from market analysts’ published predictions 
(as reported in the Institutional Brokers Estimate System) about those earnings per share.” But 
Mr. Clarke fails to specify what his “threshold amount” was. And again, the government has 
never produced in discovery data from the “Institutional Brokers Estimate System.” Expert 
Disclosure at 2. The defense simply can’t analyze Mr. Clarke’s conclusions without this vital 
information. 

Finally, Mr. Clarke is expected to testify “he identified the above traders’ first 
transactions in certain ticker symbols where [FA 2]’s logs revealed that those issuer’s financial 
information had been downloaded before the earnings announcement” and concluded “that in 
nearly all cases, the download preceded the investors’ first trade; and that that relationship 
cannot be explained by chance.” Expert Disclosure at 2 (emphasis added). Again, Mr. Clarke 
does not specify which “certain ticker symbols” he identified, which he excluded and — most 
important — which trading records he relied on. Indeed, on information and belief, Irzak and/or 
Sladkov traded before January 2018 in at least some of the same securities they traded in 2018- 
2020. See e.g., Sheehan v. Daily Racing Form, Inc., 104 F.3d 940, 942 (7th Cir. 1997) (Fisher 
Exact Test failed Daubert muster where expert arbitrarily omitted data). Moreover, Mr. Clarke 
does not identify the statistical significance of his findings — a common metric used to determine 
the accuracy of statistics. 


Federal Rule of Evidence 702 provides: 
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If scientific, technical, or other specialized knowledge will assist the trier of fact to 

understand the evidence or to determine a fact in issue, a witness qualified as an 

expert by knowledge, skill, experience, training, or education, may testify thereto 

in the form of an opinion or otherwise, if (1) the testimony is based on sufficient 

facts or data, (2) the testimony is the product of reliable principles and methods, 

and (3) the witness has applied the principles and methods reliably to the facts of 

the case. 

Fed. R. Evid. 702 (codifying Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 
(1993)). This Court exercises a “gatekeeping” function that requires it to determine, as an initial 
matter, whether proposed expert testimony meets the standards for admissibility contained in the 
rule. The proponent of the testimony bears the burden of demonstrating, by a preponderance of 
the evidence, (1) that the expert is qualified; (2) that the proposed testimony is “reliable”; and (3) 
that the proposed testimony “fits” with the facts of the case, rendering it helpful to the jury. See 
Daubert, 509 U.S. at 592 & n.10. 

Though Mr. Clarke may be qualified, the current expert disclosure is severely lacking in 
underlying “facts and data,” making it impossible to determine whether he “applied the 
[statistical] principles and methods reliably to the facts of the case.” Accordingly, the defense 
respectfully requests that this Honorable Court compel the government to produce Mr. Clarke’s 


data sets and assumptions and, if necessary, hold a Daubert hearing to determine whether his 


opinions should be excluded. 
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REQUEST TO EXCLUDE GEOLOCATION EVIDENCE 

The government intends to offer geolocation evidence from a service called geolocation 
services, including MaxMind regarding a pair of IP addresses numbered 104.238.37.190 and 
104.238.37.197. This sort of evidence has well known reliability problems. E.g., Arnold v. 
MaxMind, Inc., 216 F. Supp. 3d 1275 (D. Kan. 2016) (MaxMind misidentified 600 million IP 
addresses that had been used for illegal, immoral or embarrassing purposes with a residence in 
Kansas); see also Travis M. Andrews, LAWSUIT: HOW A QUIET KANSAS HOME WOUND UP WITH 
600 MILLION IP ADDRESSES AND A WORLD OF TROUBLE THE WASHINGTON POST (2021), 
https://www.washingtonpost.com/news/morning-mix/wp/2016/08/10/lawsuit-how-a-quiet- 
kansas-home-wound-up-with-600-million-ip-addresses-and-a-world-of-trouble/ (last visited Dec 
13, 2022) (“[MaxMind] maps IP addresses, a notoriously unreliable practice.... For its tech to 
work, MaxMind matched each IP address to a set of coordinates.... [including] mapping [m]ore 
than 600 million IP addresses [] to [a] yard.’’).” 

Absent a competent threshold proffer satisfying the strictures of Daubert v. Merrell Dow 
Pharmaceutical, 509 U.S. 579, 589 (1993),° and associated cases, this Court should exclude the 
? See also, e.g., Strike 3 Holdings, LLC v. Doe, 351 F. Supp. 3d 160, 161-62 (D.D.C. 2018) 
(Lamberth, J.) (“using geolocation technology to trace” an IP address is “famously flawed: 
virtual private networks and onion routing spoof IP addresses (for good and ill); routers and 
other devices are unsecured; malware cracks passwords and opens backdoors; multiple people 
(family, roommates, guests, neighbors, etc.) share the same IP address; a geolocation service 
might randomly assign addresses to some general location if it cannot more specifically identify 
another’) (citing James Temple, Lawsuit Says Grandma Illegally Downloaded Porn, S.F. Chron. 
(July 15, 2011, 4:00 AM), https://www.sfgate.com/business/article/Lawsuit-says-grandma- 
illegally-downloaded-porn-2354720.php)), rev ’d, 964 F.3d 1203 (D.C. Cir. 2020); cf. Strike 3 
Holdings, LLC v. Doe, No. 3:21-cv-993 (MPS), 2021 WL 4776519, at *2 n.2 (D. Conn. Oct. 13, 


2021) (noting that despite reversal, courts continue to rely on Judge Lamberth’s decision to 
impose protective conditions on even preliminary civil discovery) (collecting cases). 


3 Cf, e.g., Malibu Media, LLC v. John Does 1-13, No. 2:12—CV—177—FtM—29SPC, 2012 WL 
3962492, at *1 (M.D. Fl. Aug. 1, 2012) (deeming Daubert considerations premature and 


10 
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proposed evidence for lack of foundation. See, e.g., United States v. Crawford, No. 19-CR-170- 
RJA-MJR, 2021 WL 2367592, at *3 (W.D.N.Y. Jan. 14, 2021) (“the Government will need to 
provide an expert witness to explain and support the methods used by Google to obtain the 
geolocation data if it intends to use it as evidence at trial”), report and recommendation adopted, 
No. 19-CR-170-A, 2021 WL 1730875 (W.D.N.Y. May 3, 2021); United States v. Blouin, No. 
CR16-307 TSZ, 2017 WL 3485736, at *1, *7 (W.D. Wash. Aug. 15, 2017) (where government 
deployed “software known as RoundUp eMule” to allegedly link IP addresses to defendant’s 
computer, court allowed the evidence, but only after program developer testified at a pretrial 
hearing about “how he created the program, what the program is designed to do, and whether, in 
his opinion, the program does what was intended”’). To date, the government has not proffered 
any expert disclosure that would establish the reliability and trustworthiness of such geolocation 


Services. 


declining to engage or address them in preliminary civil discovery context), report and 
recommendation adopted, 2012 WL 3946018 (M.D. Fl. Sep. 10, 2012). 


11 
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EVIDENCE CONCERNING IGOR SLADVOK AND MIKHAIL IRZAK — INCLUDING 
THEIR TRADING ACTIVITY AND ANY OUT-OF-COURT STATEMENTS 
ATTRIBUTED TO THEM — SHOULD BE EXCLUDED ABSENT A THRESHOLD 


BOURJAILY-LIKE PROFFER 


Three defendants stand indicted in this case: Vlad Klyushin, Ivan Ermakov and Nikolai 
Rumiantcev. Though tellingly charged in a different indictment,’ two other individuals claimed 
to have traded in parallel with Klyushin through Ermakov — Igor Sladkov and Mikhail Irzak — are 
presumed to be separately unindicted coconspirators here. Without an enclosing “rim,” the mere 
presence of one common actor or “hub” (Ermakoy, as alleged) does not make a single conspiracy 
out of multiple “spokes.” Kotteakos v. U.S., 328 U.S. 750, 755 (1946). Mr. Klyushin has never 
spoken to Irzak or Sladkov. Their contact information is not saved in his phone book and there is 
no evidence that he ever knew of their existence, much less entered a conspiracy with them. 
Accordingly, absent some independent evidence preliminarily establishing the existence of a 
conspiratorial agreement among Klyushin, Sladkov and Irzak, evidence concerning the latter two 
should be excluded as irrelevant, unfairly prejudicial and/or inadmissible hearsay. See Fed. R. 


Evid. 104, 401-03, 801; Bourjaily v. U.S., 483 U.S. 171 (1987). 


“U.S. v. Irzak and Sladkov, 21 CR 10146 (D. Mass.) (NMG). 
12 
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EVIDENCE OF KLYUSHIN’S WEALTH SHOULD BE EXCLUDED 

As this Honorable Court may know, many years prior to the alleged intrusions and 
trading at issue in this case, Mr. Klyushin founded the company M-13, which specializes in the 
field of media monitoring. Its clients include government entities and private corporations, and it 
has grown to employ more than 100 people. Mr. Klyushin has amassed significant wealth — 
independent of the conduct alleged in this case — from his ownership of M-13, e.g., the apartment 
in London, U.K. that he purchased on June 21, 2013, and offered to post to secure his release. 
While the defense does not have a formal exhibit list, the Government’s “HOT DOCS” feature 
over 400 images and videos depicting Mr. Klyushin’s wealth including his trips, his homes, his 
cars, his yacht — all obtained because of the search of his iCloud account. The defense 
respectfully requests that the Court bar the Government from offering evidence or making any 
arguments at trial regarding Mr. Klyushin’s wealth. 

Evidence must be relevant to be admitted. See Fed. R. Evid. 402. Evidence is relevant if 
“(a) it has any tendency to make a fact more or less probable than it would be without the 
evidence; and (b) the fact is of consequence in determining the action.” Fed. R. Evid. 401. Even 
if relevant, evidence may be excluded “if its probative value is substantially outweighed by a 
danger of ... unfair prejudice, confusing the issues, misleading the jury, undue delay, wasting 
time, or needlessly presenting cumulative evidence.” Fed. R. Evid. 403. 

Applying these evidentiary rules, courts have long held that “[r]eference to the wealth or 
poverty of either party ... is clearly improper argument.” Garcia v. Sam Tanksley Trucking, Inc., 
708 F.2d 519, 522 (10th Cir. 1983); see also Brown v. Coleman Co., No. CIV-06-403, 2007 U.S. 
Dist. LEXIS 96221, at *3-4 (D.N.M. Sept. 17, 2007) (same) (citing United States v. Socony- 


Vacuum Oil Co., 310 U.S. 150, 239 (1940) for the proposition that “appeals to class prejudice are 


13 


Case 1:21-cr-10104-PBS Document 119 Filed 12/19/22 Page 14 of 21 


highly improper and cannot be condoned and trial courts should ever be alert to prevent them’). 
Indeed, “arguments to the jury about a defendant’s wealth are grounds for a new trial.” United 
States ex rel. Miller v. Bill Harbert Int'l Constr., Inc., 608 F.3d 871, 897 (D.C. Cir. 2010) 
(vacating judgments and remanding for new trial against two defendants where trial court 
allowed counsel to elicit irrelevant and prejudicial testimony regarding their wealth). 

Evidence regarding Mr. Klyushin’s income and wealth is not relevant because it will not 
make any fact of consequence in this case more or less probable — especially given Mr. 
Klyushin’s accumulation of wealth prior to the alleged conspiracy in this case. See Fed. R. Evid. 
401. The factual issues before the jury will relate to whether Mr. Klyushin willingly, knowingly, 
and intentionally participated in the charged hack-and-trade scheme. Evidence regarding his 
income and wealth has nothing to do with those factual issues. Even if evidence regarding Mr. 
Klyushin’s income or wealth were theoretically relevant, its minimal probative value pales 
against the attending danger of unfair prejudice. See Fed. R. Evid. 403. Mr. Klyushin’s income 
and wealth have no direct connection to the factual issues to be decided by the jury, and any 
indirect connection (presuming one exists) is at best attenuated and speculative. Indeed, courts 
have regularly recognized the clear prejudicial potential impact of such evidence. See, e.g., L-3 
Commc'ns Corp. v. OST Sys., Inc., No. 02Civ.914, 2006 WL 988143, at *6 (S.D.N.Y. Apr. 13, 
2006) (granting motion in limine to exclude evidence of witness’s wealth and lifestyle because it 
was irrelevant “and its inclusion would be unfairly prejudicial’). 

Finally, to the extent the government contends that pictures and videos showing Messrs. 
Klyushin and Ermakov together prove a personal relationship potentially bearing on whether 
they would have entered a conspiracy, much of the evidence still fails Rule 403 scrutiny as 


unfairly prejudicial. Though some friendship evidence may be relevant, the government simply 


14 
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does not need the excessive number of pictures and videos of the two at parties, vacations, and 
other events that it proposes to admit. 

A case in point is United States v. Varoudakis, 233 F.3d 113 (1st Cir. 2000). There, the 
Court held that evidence the defendant had previously involved his girlfriend in the arson of a car 
was properly admissible under Rule 404(b) in a case in which the defendant was charged with 
conspiring with his girlfriend to commit arson of his nightclub because “because it show[ed] that 
he trusted her so much that he was willing to commit a crime in her presence.” /d. at 121. The 
evidence should, however, have been excluded under Rule 403, the Court concluded. “The 
prejudice to an opponent can be said to be ‘unfair’ when the proponent of the evidence could 
prove the fact by other, non-prejudicial evidence.” /d. at 122. The government did not need the 
car fire evidence because it had other evidence showing the close relationship between the 
defendant and his girlfriend, and defendant did not dispute that his girlfriend was involved in his 
business affairs as well as his personal life. Jd. at 123-24. See, e.g., United States v. Morley, 199 
F.3d 129, 135-36 (3d Cir. 1999) (evidence not necessary to show relationship between the 
defendant and another man because “that was a given from the very beginning”). So too here, 
where the defense does not dispute that Mr. Klyushin and Mr. Ermakov had a personal 
relationship and the Government has non-inflammatory evidence to prove their friendship, e.g., 


communications among and pictures of the two at events that do not depict excessive wealth. 


15 
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THE GOVERNMENT SHOULD BE PRECLUDED FROM ARGUING TRADING IS 
BASED ON MATERIAL NON-PUBLIC INFORMATION UNLESS IT CAN PROVE 
THAT TRADING FOLLOWS AN UNATHORIZED INTRUSION BY MR. KLYUSHIN 
OR A COCONSPIRATOR 

While it may seem a non-issue with Mr. Klyushin and his co-conspirators accused of 
carrying out a hack-and-trade scheme, significant prejudice will ensue if the government is 
permitted to introduce evidence of trading and argue that it was based on illicit information 
without first proving the information was unlawfully accessed by Mr. Klyushin or a co- 
conspirator. Mr. Klyushin engaged in trading starting on June 19, 2018 and accounts in his name 
continued trading post-arrest up through May 21, 2021. At the same time, log records from FA 1 
extend only from January 2019 through February 2020, and log records from FA 2 extend from 
February through May 2020. To allow the government to introduce allegedly illicit transactions 
not based on any unauthorized intrusion would put the cart before the proverbial horse. 

Based on the defense’s review of the discovery, the evidence of unauthorized intrusion 
into FA 1’s and FA 2’s servers is scant. The evidence is primarily in the form of log files from 
the two filing agents that depict a user’s access to the database from 250+ IP addresses.° The log 
files purportedly depict activity that is both authorized — an employee lawfully accessing the 
database — and unauthorized — access by hackers — and it is impossible to determine which access 
is which. Indeed, the log files depict access to 1200+ individual companies, 800+ of which Mr. 
Klyushin and his coconspirators never traded. Mr. Klyushin’s trading records similarly depict 


hundreds of transactions that are not correlated with a preceding unauthorized intrusion. The 


defense previously asked the government to identify the IP addresses it will claim belonged to 


> Most of FA 1’s log files are missing any IP address information, making it impossible to 
determine whether the server was accessed by an authorized employee or an unauthorized 
intruder. 
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unauthorized intruders. Instead, the government pointed the defense to the charging documents, 
which depict only a handful of transactions falling far short of the $82.5 million profit figure — 
one the government may seek to introduce at trial — floated in other filings. Moreover, the IP 
addresses associated with the unauthorized intrusions outlined in the charging documents do not 
correspond to any IP addresses used by Mr. Klyushin. The sole overlap is one address that 
accessed FA 2’s server on May 9, 2018, which was also associated with an update of Ermakov’s 
MacBook. Mr. Klyushin, however, never transacted in the companies allegedly accessed on May 
9, 2018. 

It is axiomatic that evidence of trading and resulting profits is irrelevant unless based on 
information obtained through unauthorized intrusions of FA 1 and FA 2 by Mr. Klyushin or a co- 
conspirator. See Fed. R. Evid. 401; see also Fed. R. Evid. 104(b) (“When the relevance of 
evidence depends on whether a fact exists, proof must be introduced sufficient to support a 
finding that the fact does exist.””). And even if somehow relevant, evidence of trading 
unconnected to an intrusion should nonetheless be excluded “if its probative value is 
substantially outweighed by a danger of ... unfair prejudice, confusing the issues, misleading the 
jury, undue delay, wasting time, or needlessly presenting cumulative evidence.” Fed. R. Evid. 
403. The specter of unfair prejudice looms large here, especially if prosecutors (a) offer evidence 
of trading in hundreds of stocks yielding tens of millions in gains, while (b) only offering 
evidence of a handful of unauthorized intrusions — or even just one — by the charged parties. 
Such a scenario would impermissibly invite the jury to surmise that evidence of trading alone 


suffices to prove trading based on material non-public information. 
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EVIDENCE OF ERMAKOV’S EMPLOYMENT AND M-13’S CYBER SECURITY 
SERVICE SHOULD BE EXCLUDED 


On information and belief, the government will seek to introduce evidence that (1) Mr. 


Ermakov was employed by M-13 and (2) M-13 provided cyber security consulting, penetration 


testing, and advanced persistent threat emulation. Both propositions are irrelevant, however, 


unless prevailing during the alleged Jan. 2018-Sep. 2020 lifespan of the charged conspiracy. 


Otherwise the evidence is highly misleading and invites improper conclusions, i.e., that Mr. 


Ermakov worked for M-13 throughout the conspiracy’s duration, and M-13 provided cyber 


security services and had the requisite expertise to conduct the alleged unlawful intrusions. 


The government relies on one document to prove that Mr. Ermakov was employed by M- 


13. That document, however, was created in April 2020. Prior to that, there is no record that Mr. 


Ermakov ever worked for M-13. Indeed, it was not until May 2019 when Mr. Klyushin texted 


Mr. Ermakov, complaining about his then-current position, with an invitation to work for M-13: 


DATE/TIME (ET) 


5/5/2019 4:54:59 AM 


FROM NAME 


Vladislav Klyushin 


TO NAME 


VsaH Epmakos 


TEXT 
Greetings! How is it going for you? Are 
you working tomorrow or on vacation? 
We are doing well) 


5/5/2019 4:55:25 AM 


VsaH Epmakos 


Vladislav Klyushin 


Greetings! | am doing fine, only | don’t 
want to go to work tomorrow! 


5/5/2019 4:57:40 AM 


Vladislav Klyushin 


VsaH Epmakos 


&} if you were only at M13... 


5/5/2019 4:58:13 AM 


Vladislav Klyushin 


VsaH Epmakos 


You would have slaved with no weekends 
off)) 


5/5/2019 4:58:17 AM 


Vladislav Klyushin 


VsaH Epmakos 


But remotely. 


5/5/2019 4:59:28 AM 


VsaH Epmakos 


Vladislav Klyushin 


Right:) 


5/5/2019 5:02:10 AM 


VisaH Epmakos 


Vladislav Klyushin 


But | do this anyway} 


5/5/2019 5:02:23 AM 


VsaH Epmakos 


Vladislav Klyushin 


This too, by the way:) 


5/5/2019 5:03:00 AM 


VsaH Epmakos 


Vladislav Klyushin 


You have great views there! 


5/5/2019 5:03:48 AM 


Vladislav Klyushin 


VisaH Epmakos 


Yep, pretty nice. 


There is no evidence that Mr. Ermakov accepted the offer. Indeed, based on a request, the 


Russian Federal Taxation Service Inspection Department confirmed it has no records of Mr. 


Ermakov’s employment with M-13 during 2018—20, see Exhibit 2. Accordingly, the government 
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should be precluded from arguing that Mr. Ermakov was employed by M-13 during the entirety 
of the conspiracy period. At earliest, evidence of Mr. Ermakov’s employment starts in April 
2020. Allowing the government to expand that temporal period to encompass 2018-19 would 
allow it to mislead the jury that Mr. Ermakov worked for Mr. Klyushin’s company during the 
entire conspiracy period. 

Similarly, the version of the website that the government seeks to introduce into evidence 
is from 2021. However, the services that M-13 offered outside of the conspiracy period is 
irrelevant. Admitting the 2021 version of the website would allow the jury to impermissibly 
presume that what was true and accurate as of 2021 was also accurate as early as January 2018. 
Indeed, based on the defense’s review, the first time that the relevant advertisement appeared on 
the M-13 website was on September 28, 2020, after or at the tail end of the charged conspiracy. 
See https://web.archive.org/web/2020092823091 I/https://www.m13.ru/it-security. Accordingly, 
the government’s use of that evidence should be precluded as irrelevant under Fed. R. Evid. 401 
and unduly prejudicial under Fed. R. Evid. 403. Alternatively, if there is some semblance of 
relevance because M-13 provided these services at the end or after the end of the conspiracy 
period, the government should be limited to arguing that these services were only made available 


by M-13 as of September 28, 2020. 
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THE DEFENSE REQUESTS THAT MR. KLYUSHIN BE DETAINED NEAR THE 
COURT DURING THE PENDENCY OF HIS TRIAL OR ALTERNATIVELY TO 
RELEASE HIM TO THE CUSTODY OF HIS ATTORNEYS DURING TRIAL 

Mr. Klyushin is currently being held at the Plymouth County Correctional Facility. The 
facility is approximately 40 miles away from the Court. To facilitate Mr. Klyushin’s appearance 
before the Court’s prior hearing, the facility wakes Mr. Klyushin at 5am and transports him to 
Court in handcuffs. This stressful trip could take as long as two hours in each direction. At the 
end of the day, Mr. Klyushin did not return to the facility until 7 or 8 pm. The defense worries 
that if held at the Plymouth County Correctional Facility during trial, Mr. Klyushin’s sleep 
deprivation and inability to communicate with counsel for much of the day will impair his ability 
to mount a complete defense. Accordingly, the defense respectfully requests that Mr. Klyushin 
be detained near the Court during the pendency of trial, and in such manner as to avoid sleep 
deprivation and allow him access to counsel. If these arrangements are impossible, the defense 
would respectfully request this Honorable Court to consider releasing Mr. Klyushin to the 
custody of his counsel or under conditions requiring his 24/7 supervision by private security or 
the Marshal’s Office (at his expense), who could reside at a hotel next to the Court that could be 
approved by the Court, the Marshal’s Office, and/or pretrial services in advance. See 
https://www.politico.com/news/2022/1 1/10/jan-6-defendant-who-posted-violent-diatribes- 
granted-pretrial-release-00066261 ?nname=politico-nightly &nid=00000170-c000-da87-af78- 
el 85fa700000 &nrid= 000001 4e-f1 1 1-dd93-ad7f-f915fd840000 &nlid=2670445 (Judge Thomas 
Hogan of the District of Columbia, who had initially ordered and repeatedly upheld a January 6 
defendant’s pretrial incarceration, released the defendant on pretrial conditions to facilitate 
preparation for trial despite defendant being a danger to the community); United States v. 


Nichols, 21-cr-00117-TFH, Dkt. 180 (D.C.). 
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Respectfully Submitted, 
Vladislav Klyushin, 
By His Attorney, 


/s/ Maksim Nemtsev 
Maksim Nemtsev, Esq. 
Mass. Bar No. 690826 
20 Park Plaza, Suite 1000 
Boston, MA 02116 

(617) 227-3700 
menemtsev @ gmail.com 


/s/ Marc Fernich 

Marc Fernich 

Law Office of Marc Fernich 
800 Third Avenue 

Floor 20 

New York, NY 10022 
212-446-2346 

Email: maf @fernichlaw.com 


Dated: December 19, 2022 


CERTIFICATE OF SERVICE 


I, Maksim Nemtsev, hereby certify that on this date, December 19, 2022, a copy of the 
foregoing documents has been served via Electronic Court Filing system on all registered 
participants. 


/s/ Maksim Nemtsev 
Maksim Nemtsev, Esq. 
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